Description
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| froxlor | froxlor | 2.3.8 – < 2.3.15 | 2.3.15 |
Advisories 1
- WID-SEC-2026-4050 Froxlor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
References
- GitHub Security Advisory (GHSA-5fm2-8wxf-xc5v) vendor-advisory
- VulnCheck Advisory: Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php third-party-advisory